Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

Is there a way to encrypt a folder, which is not in Home (/home/user/) but even in a different partition, so only my user can access/read contained files?

Alternatively, I would like to understand if it is possible to turn a complete ext4 partition into an encrypted volume, which would be mounted at user login.

If possible, I would like to make the change without reinstalling Ubuntu.

My PC has (mount output):

/dev/sda1 on / type ext4 (rw,errors=remount-ro)
/dev/sda3 on /home type ext4 (rw)
/dev/sda4 on /home/igor/Personale type ext4 (rw)

sda4 is the partition containing folders I would like to protect.

share|improve this question

marked as duplicate by Eric Carvalho, dn-ʞɔɐq ɹW, Mitch Jan 30 '15 at 16:09

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Related:… – landroni Jan 24 '15 at 8:15
up vote 1 down vote accepted

eCryptfs would be a good choice (Ubuntu encrypted home directory uses ecryptfs) if you want to encrypt /dev/sda4 which is mounted as /home/igor/Personale type ext4

You don't have to re-install anyway. ecryptfs is flexible (you can encrypt folders or partitions) and easy to use, it is layered on top of the current file system - ext4 in your case. Basically you have a partition/block device, create file system and mount it, then use ecryptfs to encrypt it.

In your case, it's /dev/sda4, to encrypt it NOTE: although this process retains existing data I strongly recommend backing up to a different partition or external HDD. Because later on we need to copy it back to get data encrypted (existing data won't get encrypted).


  1. install ecryptfs-utils package 1st

    sudo apt-get install ecryptfs-utils
  2. mount the destination directory as ecryptfs (suppose /dev/sda4 already mounted on /home/igor/Personale)

    mount -t ecryptfs /home/igor/Personale /home/igor/Personale

NOTE: You will be prompted for pass phrase, cipher, key bytes, plaintext passthrough (y/n), filename encryption (y/n).

Done. Existing data won't be encrypted anyway, you can delete existing data and copy if from backup (that's why I recommended backing up, a data swap is needed to activate encryption on existing files). Use rsync for backup/restore:

    rsync -axHAX /backup /home/igor/Personale

BTW: you can see the encrypted partition use findmnt or mount, e.g /home/terry/topsecret on /home/terry/topsecret type ecryptfs (rw,ecryptfs_sig=633937dbcf1fef34,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_unlink_sigs)

share|improve this answer
If I go this way, will I have to manually mount the ecryptfs at every login? – igi Nov 6 '12 at 19:35
@igi No, you don't have to manually mount it every time. You can use .ecryptfsrc and set up automatic mount. Check this out – Terry Wang Nov 7 '12 at 9:34

Sure. You can use enfcs, for example, to create an encrypted folder anywhere. Install encfs with sudo apt-get install encfs.

mkdir /path/to/encrypted
mkdir /path/do/decrypted
encfs /path/to/encrypted /path/to/decrypted

When run on a given encrypted directory for the first time, encfs will take you through setting the password and encryption options.

To unmount the encrypted folder, type

fusermount -u /path/to/decrypted

To mount the encrypted directory again, type the same command you used to encrypt it:

encfs /path/to/encrypted /path/to/decrypted

Note that encryption is quite different from Unix permissions ("only my user can access..."). In short, any person and only a person with the credentials (password to the encrypted directory) can decrypt it. That is rather the point of it, because anyone with physical access to your machine can become root, and consequently -- also any user, including you. It is as simple as booting the computer with a live cd or taking out the drive and connecting it to another system.

share|improve this answer
Thanks January, so in this case I would need to manually mount folders (or make a script) at every login. Am I correct? – igi Sep 23 '12 at 12:46
Yes, if you choose that way. No idea how to do it differently. – January Sep 23 '12 at 15:51
I tried using cryptkeeper on top of encfs, but it resulted in errors. – igi Sep 23 '12 at 19:09

You can also use LUKS to make an encrypted container which can be used. This has the added effect of being more secure, only the passphrase will open the container. Here is an example:

Create crypto container, loop, and device

  • dd if=/dev/urandom of=/mnt/sdcard/loop1.img bs=1M count=128

  • losetup /dev/block/loop1 /mnt/sdcard/loop1.img

  • cryptsetup -c aes-plain luksFormat /dev/block/loop1

  • cryptsetup luksOpen /dev/block/loop1 cpt1

  • mkfs.ext2 /dev/mapper/cpt1

  • mkdir /mnt/sdcard/safe

  • mount /dev/mapper/cpt1 /mnt/sdcard/safe

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.